Loading ...

Play interactive tourEdit tour

Windows Analysis Report correction HAWB.exe

Overview

General Information

Sample Name:correction HAWB.exe
Analysis ID:502575
MD5:8a29580d47943a0f2c61ca552a63bc30
SHA1:e4cdec934b4bfc2e055216c03ac7056069100b05
SHA256:53c0cf2d25f350a579729af76c466b68b899586b620ffae8925fcb4d831dc2c8
Tags:exe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Potential malicious icon found
Yara detected GuLoader
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Program does not show much activity (idle)
Uses code obfuscation techniques (call, push, ret)
Abnormal high CPU Usage
Detected potential crypto function
Found potential string decryption / allocating functions

Classification

Process Tree

  • System is w10x64
  • correction HAWB.exe (PID: 4784 cmdline: 'C:\Users\user\Desktop\correction HAWB.exe' MD5: 8A29580D47943A0F2C61CA552A63BC30)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=d"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.758213767.0000000002110000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.758213767.0000000002110000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=d"}
    Machine Learning detection for sampleShow sources
    Source: correction HAWB.exeJoe Sandbox ML: detected
    Source: correction HAWB.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=d

    System Summary:

    barindex
    Potential malicious icon foundShow sources
    Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
    Source: correction HAWB.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: correction HAWB.exe, 00000000.00000002.758468268.0000000002890000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUnelega5.exeFE2X vs correction HAWB.exe
    Source: correction HAWB.exe, 00000000.00000000.230189845.000000000041C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUnelega5.exe vs correction HAWB.exe
    Source: correction HAWB.exeBinary or memory string: OriginalFilenameUnelega5.exe vs correction HAWB.exe
    Source: correction HAWB.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess Stats: CPU usage > 98%
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004022BB0_2_004022BB
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004034440_2_00403444
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_0040322C0_2_0040322C
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004034DC0_2_004034DC
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004032B60_2_004032B6
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_0040333F0_2_0040333F
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004033CA0_2_004033CA
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004031AB0_2_004031AB
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: String function: 0040177E appears 94 times
    Source: correction HAWB.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\correction HAWB.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: classification engineClassification label: mal76.rans.troj.evad.winEXE@1/0@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.758213767.0000000002110000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_00403C72 push eax; iretd 0_2_00403C73
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_0040440B pushad ; iretd 0_2_00404415
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_00405ADE push esi; ret 0_2_00405AEC
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_00406AE7 push ss; iretd 0_2_00406AE8
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_0040695C push eax; ret 0_2_00406974
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_00406F76 push 0000002Ch; iretd 0_2_00406F78
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004057DC push ecx; ret 0_2_004057E0
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_00407BBE push eax; retf 0_2_00407BBF
    Source: initial sampleStatic PE information: section name: .text entropy: 6.82320580255
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\correction HAWB.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004022BB mov ebx, dword ptr fs:[00000030h]0_2_004022BB
    Source: C:\Users\user\Desktop\correction HAWB.exeCode function: 0_2_004031AB mov ebx, dword ptr fs:[00000030h]0_2_004031AB
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: correction HAWB.exe, 00000000.00000002.757533942.0000000000C60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: correction HAWB.exe, 00000000.00000002.757533942.0000000000C60000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: correction HAWB.exe, 00000000.00000002.757533942.0000000000C60000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
    Source: correction HAWB.exe, 00000000.00000002.757533942.0000000000C60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
    Source: correction HAWB.exe, 00000000.00000002.757533942.0000000000C60000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSSystem Information Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information3LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    correction HAWB.exe100%Joe Sandbox ML

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:33.0.0 White Diamond
    Analysis ID:502575
    Start date:14.10.2021
    Start time:04:25:07
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 7m 9s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:correction HAWB.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:32
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal76.rans.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 3.7% (good quality ratio 3%)
    • Quality average: 37.6%
    • Quality standard deviation: 20.2%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
    • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.50.102.62, 23.203.141.148, 95.100.216.89, 20.82.210.154, 40.112.88.60, 2.20.178.24, 2.20.178.33, 20.82.209.183, 20.54.110.249
    • Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):6.349869263832848
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:correction HAWB.exe
    File size:135168
    MD5:8a29580d47943a0f2c61ca552a63bc30
    SHA1:e4cdec934b4bfc2e055216c03ac7056069100b05
    SHA256:53c0cf2d25f350a579729af76c466b68b899586b620ffae8925fcb4d831dc2c8
    SHA512:358c751d102753fd81e1d527a438ca7aed36dec3d605e870a4bf3f3232027ae1d66db2c8c70771c6e781f3a52317ddec0e483b4dce501c5ef30cc1189f217177
    SSDEEP:1536:VTbVTmIJnm6UC/HuomaUi0gAC6/lHzDc7uWWDNvtKyUrWBeSVpynmKTGYFZnymht:V/VTVnbHJ/Tkl/eS3ybzH
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......Y.....................`......h.............@.............B..

    File Icon

    Icon Hash:20047c7c70f0e004

    Static PE Info

    General

    Entrypoint:0x401868
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x59B6E088 [Mon Sep 11 19:14:16 2017 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:c727a98e677fb7bd25bb06d2a2d956f1

    Entrypoint Preview

    Instruction
    push 00410420h
    call 00007F054CD2BED5h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    cmp byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    jecxz 00007F054CD2BE87h
    out dx, eax
    pushad

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x1a9a40x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1c0000x456a.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x154.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x19ee00x1a000False0.56938288762data6.82320580255IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x1b0000xaf00x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x1c0000x456a0x5000False0.396240234375data4.60844428158IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    DATA0x1ca7c0x3aeeMS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixelEnglishUnited States
    RT_ICON0x1c94c0x130data
    RT_ICON0x1c6640x2e8data
    RT_ICON0x1c53c0x128GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x1c50c0x30data
    RT_VERSION0x1c1a00x36cdataEnglishUnited States

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

    Version Infos

    DescriptionData
    Translation0x0409 0x04b0
    LegalCopyrightRealNetworks, Inc.
    InternalNameUnelega5
    FileVersion66.00
    CompanyNameRealNetworks, Inc.
    LegalTrademarksRealNetworks, Inc.
    CommentsRealNetworks, Inc.
    ProductNameRealNetworks, Inc.
    ProductVersion66.00
    FileDescriptionRealNetworks, Inc.
    OriginalFilenameUnelega5.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:04:25:59
    Start date:14/10/2021
    Path:C:\Users\user\Desktop\correction HAWB.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\correction HAWB.exe'
    Imagebase:0x400000
    File size:135168 bytes
    MD5 hash:8A29580D47943A0F2C61CA552A63BC30
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.758213767.0000000002110000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Executed Functions

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: 843852562e97c02061be24c1266aa81e23cdbba38b66fb3b6043fdb9c8fad410
      • Instruction ID: 0dbeb7ba8126c2d16b5cec56c07c5d44435747c0479f7f7bb207e66cb8e8daab
      • Opcode Fuzzy Hash: 843852562e97c02061be24c1266aa81e23cdbba38b66fb3b6043fdb9c8fad410
      • Instruction Fuzzy Hash: F90370137CE3C087CF174679A4A04E57FA24F9F12933DB9ED90E99A276DB7688058A04
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: f7e30e259396097108a8fdae1f19d83c16d710aeadd485eaf34f97214f4e3681
      • Instruction ID: bca97508a087566364f66d491995ac56d1b79cd3bf2bb8b60e3e608e18770c45
      • Opcode Fuzzy Hash: f7e30e259396097108a8fdae1f19d83c16d710aeadd485eaf34f97214f4e3681
      • Instruction Fuzzy Hash: 7CD16C26B197000B875E98BE44D0967C4C79FEE26133AE63D652EF73A9ED79CC0A114C
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: c5e6d4e4c15e5934a1ed92f140f8530431e225ce0f987044aed296c79c6bd023
      • Instruction ID: d80fed9989516cd55a5bfc590f532bd83aace0f9dab7992851092243115df025
      • Opcode Fuzzy Hash: c5e6d4e4c15e5934a1ed92f140f8530431e225ce0f987044aed296c79c6bd023
      • Instruction Fuzzy Hash: B3C16C26B197000B875E98BE49D0867C4C79FEE26132AE63D652DF73A9ED79CC0A114C
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: 6bd37713fb9798e92e472aaa1db6594e9c3de6cb29c79accd2bed858b3433707
      • Instruction ID: 0d6ed812f99a8c451ee799c0e2bd864be07ed93e4c204d0e57fc8337d68620cb
      • Opcode Fuzzy Hash: 6bd37713fb9798e92e472aaa1db6594e9c3de6cb29c79accd2bed858b3433707
      • Instruction Fuzzy Hash: E4B16D26B197004B875D98BE44D08ABC0C79FEF26172AE63D651DF33A5ED79CD0A114C
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID: Fz(
      • API String ID: 0-1798509030
      • Opcode ID: 64b6e5243834087a55edbc57533f392de98b28250c2484c3719a7eaa988bfd1f
      • Instruction ID: 4e7c218a0db1f637ee49cd187d517da33016375141d6ae08174755130913fc25
      • Opcode Fuzzy Hash: 64b6e5243834087a55edbc57533f392de98b28250c2484c3719a7eaa988bfd1f
      • Instruction Fuzzy Hash: D2C17B26B197000B875E98BE48D096BC4C79FEF25172AE63D652EF33A5ED79CC0A114C
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID: Fz(
      • API String ID: 0-1798509030
      • Opcode ID: f3e53883f3f0bf8d5b9fcae8cf5720b4f5911cf3ebd3e53febfe2d6b3f3c5ff5
      • Instruction ID: 371a81c427e8b3ab8fd0061f52c07c2579278d6e3e007355877e079342c34c1b
      • Opcode Fuzzy Hash: f3e53883f3f0bf8d5b9fcae8cf5720b4f5911cf3ebd3e53febfe2d6b3f3c5ff5
      • Instruction Fuzzy Hash: 9DA16C66F197004B875E98BE44D08ABC0C79FEF25132AE63D651EF33A5ED79CD0A1148
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID: Fz(
      • API String ID: 0-1798509030
      • Opcode ID: 31ddc104eec15b07c9fc1e30c9c2d176d233ae51eeb4d9d1289021286b1b7a2d
      • Instruction ID: f129749623794028e2216c73311acaf3e9d18c1eca37c4f6ec86e2b370756ae1
      • Opcode Fuzzy Hash: 31ddc104eec15b07c9fc1e30c9c2d176d233ae51eeb4d9d1289021286b1b7a2d
      • Instruction Fuzzy Hash: E1919D26B1A7000B875E98BE44D08A7C0C78FEE25173AE63D652EF33A5ED79CD0B1148
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: 4a2a43da2e49ecfd64bbe19e36849a068a408c2f73c056a769618e0f5a690a00
      • Instruction ID: bdf12f4b43857e4b748fa8db444fcbcbdded70efdefbe63fe0628656f92821db
      • Opcode Fuzzy Hash: 4a2a43da2e49ecfd64bbe19e36849a068a408c2f73c056a769618e0f5a690a00
      • Instruction Fuzzy Hash: 04817D66B197000B875E98BE45D0897C0C78FEE26163AE63D652EF33A5ED79CD0B1148
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: ====$====$====$====$====$====$====$====$====$====$Fz(
      • API String ID: 4275171209-143834432
      • Opcode ID: e913b78178534356403cd5cc241e32b62e4f9e5e6a7da3b19f2b2c68c068d910
      • Instruction ID: 7519d0af830130df06bd1f8e24d4eb9b3b2f6a0f5881c646626a5e23563109ab
      • Opcode Fuzzy Hash: e913b78178534356403cd5cc241e32b62e4f9e5e6a7da3b19f2b2c68c068d910
      • Instruction Fuzzy Hash: 54718D66F1A7000B875E98BE45D089BC0C79FEE25133AE63D612EE33A5ED79CD0B1148
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: c3427f421072fdeeea1ea542dd412ac4da689aab563e54e36cc002528031c06c
      • Instruction ID: e1ec094a921dcbcee67fb21ceee7025142180f13b59ccba8cdbeda861a95c66d
      • Opcode Fuzzy Hash: c3427f421072fdeeea1ea542dd412ac4da689aab563e54e36cc002528031c06c
      • Instruction Fuzzy Hash: 69D04EA6A0E3C06ED3032A3108221413FB14C2364430F84E3E680EF0F3D05C0C48833A
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: 74205d7028e45ffe8771a03d92a2c999d7d136ad463f9c889fe0ff623ac3a16a
      • Instruction ID: 6e7fd5ffba9a380893297a27ae54f1ba3fe65413e89db9f52eff76a8e4ea1a6f
      • Opcode Fuzzy Hash: 74205d7028e45ffe8771a03d92a2c999d7d136ad463f9c889fe0ff623ac3a16a
      • Instruction Fuzzy Hash: 29617D62F197000B875E98BE45D0497D0C79FEE25137AE63D612EE33A9EDB9CD0B1188
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID: Fz(
      • API String ID: 0-1798509030
      • Opcode ID: 75623b10c0c77bc0247f46ca57456758b4556246403d376bda37314ce2d0eb9d
      • Instruction ID: 5ede746b361072b7f5df76cdd00f5846d6e49d2014e23c2e3759f1900f28a508
      • Opcode Fuzzy Hash: 75623b10c0c77bc0247f46ca57456758b4556246403d376bda37314ce2d0eb9d
      • Instruction Fuzzy Hash: BC517C62F0A7000B875E98BE45D0897D0C79FEE25177AE63D612DE3369ED79CD0B1188
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: ac13edeeb73699eae36f5000f53aba56dfde1f178f3951abce95db8ef70581e7
      • Instruction ID: 64011b86c888f0b28c8b9f389eb7fd61748ed85e07c4c5b015399ed0015f1d01
      • Opcode Fuzzy Hash: ac13edeeb73699eae36f5000f53aba56dfde1f178f3951abce95db8ef70581e7
      • Instruction Fuzzy Hash: 7451A062F197000B875E98BE44D08A7D0C79FEE25177AE63D611EE3365EDB8CC0B1288
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,00011000,-D363868A,6C033B6F), ref: 004037CB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: Fz(
      • API String ID: 4275171209-1798509030
      • Opcode ID: 25d178d3f5379c947a45b1c1a7c62345b0e4794ba763df8c0e480c2180aee8e5
      • Instruction ID: ae8b798ee7aed9d50f88841d5c581762eef8e35f66c4514a4a704dfa62a55a66
      • Opcode Fuzzy Hash: 25d178d3f5379c947a45b1c1a7c62345b0e4794ba763df8c0e480c2180aee8e5
      • Instruction Fuzzy Hash: AD41B322B1A7000B8B5E58BE84D045BD4C79FEF211779E63D611EE33A5EDB9CD0B1148
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      C-Code - Quality: 53%
      			E0041A60B(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
      				char _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				char _v32;
      				char _v36;
      				void* _v44;
      				intOrPtr _v52;
      				char _v60;
      				intOrPtr _v68;
      				char _v76;
      				char _v80;
      				char* _t56;
      				void* _t58;
      				intOrPtr* _t59;
      				void* _t60;
      				void* _t62;
      				intOrPtr* _t63;
      				void* _t64;
      				void* _t66;
      				intOrPtr* _t67;
      				void* _t68;
      				void* _t71;
      				intOrPtr* _t72;
      				void* _t73;
      				char _t75;
      				intOrPtr _t76;
      				void* _t107;
      				intOrPtr* _t109;
      				intOrPtr* _t111;
      				intOrPtr* _t112;
      				intOrPtr* _t113;
      				intOrPtr* _t114;
      				intOrPtr* _t115;
      				intOrPtr* _t116;
      				intOrPtr* _t117;
      				intOrPtr* _t118;
      				void* _t119;
      				void* _t121;
      				intOrPtr _t122;
      				void* _t126;
      				void* _t135;
      
      				_t122 = _t121 - 0xc;
      				 *[fs:0x0] = _t122;
      				_v16 = _t122 - 0x50;
      				_v12 = 0x401650;
      				_t75 = 0;
      				_v8 = 0;
      				_t109 = _a4;
      				 *((intOrPtr*)( *_t109 + 4))(_t109, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t119);
      				_v28 = 0;
      				_v32 = 0;
      				_v36 = 0;
      				_v44 = 0;
      				_v60 = 0;
      				_v76 = 0;
      				_v80 = 0;
      				L0040177E();
      				_v68 = _t109;
      				_v76 = 9;
      				L00401760();
      				_t56 =  &_v60;
      				_push(_t56);
      				L0040170C();
      				L00401802();
      				if( ~(0 | _t56 != 0x0000ffff) == 0) {
      					_t107 = 0x4120a4;
      				} else {
      					_t126 =  *0x41b380 - _t75; // 0x2a8e8cc
      					if(_t126 == 0) {
      						_push(0x41b380);
      						_push(0x4120b4);
      						L00401838();
      					}
      					_t113 =  *0x41b380; // 0x2a8e8cc
      					_t62 =  *((intOrPtr*)( *_t113 + 0x14))(_t113,  &_v44);
      					asm("fclex");
      					if(_t62 >= _t75) {
      						_t107 = 0x4120a4;
      					} else {
      						_t107 = 0x4120a4;
      						_push(0x14);
      						_push(0x4120a4);
      						_push(_t113);
      						_push(_t62);
      						L00401832();
      					}
      					_t63 = _v44;
      					_t76 = 1;
      					_t114 = _t63;
      					_t64 =  *((intOrPtr*)( *_t63 + 0x138))(_t63, L"Sprinkelvrkernes", _t76);
      					asm("fclex");
      					if(_t64 < 0) {
      						_push(0x138);
      						_push(0x4120c4);
      						_push(_t114);
      						_push(_t64);
      						L00401832();
      					}
      					L0040182C();
      					if( *0x41b380 == 0) {
      						_push(0x41b380);
      						_push(0x4120b4);
      						L00401838();
      					}
      					_t115 =  *0x41b380; // 0x2a8e8cc
      					_t66 =  *((intOrPtr*)( *_t115 + 0x14))(_t115,  &_v44);
      					asm("fclex");
      					if(_t66 < 0) {
      						_push(0x14);
      						_push(_t107);
      						_push(_t115);
      						_push(_t66);
      						L00401832();
      					}
      					_t67 = _v44;
      					_t116 = _t67;
      					_t68 =  *((intOrPtr*)( *_t67 + 0x138))(_t67, L"Inferencing", _t76);
      					asm("fclex");
      					if(_t68 < 0) {
      						_push(0x138);
      						_push(0x4120c4);
      						_push(_t116);
      						_push(_t68);
      						L00401832();
      					}
      					L0040182C();
      					_push(0);
      					_push( &_v60);
      					_v52 = _t76;
      					_v60 = 2;
      					L0040171E();
      					L0040183E();
      					L00401802();
      					if( *0x41b380 == 0) {
      						_push(0x41b380);
      						_push(0x4120b4);
      						L00401838();
      					}
      					_t117 =  *0x41b380; // 0x2a8e8cc
      					_t71 =  *((intOrPtr*)( *_t117 + 0x1c))(_t117,  &_v44);
      					asm("fclex");
      					if(_t71 < 0) {
      						_push(0x1c);
      						_push(_t107);
      						_push(_t117);
      						_push(_t71);
      						L00401832();
      					}
      					_t72 = _v44;
      					_t118 = _t72;
      					_t73 =  *((intOrPtr*)( *_t72 + 0x50))(_t72);
      					asm("fclex");
      					if(_t73 < 0) {
      						_push(0x50);
      						_push(0x4120f8);
      						_push(_t118);
      						_push(_t73);
      						L00401832();
      					}
      					L0040182C();
      					_t75 = 0;
      				}
      				_t135 =  *0x41b380 - _t75; // 0x2a8e8cc
      				if(_t135 == 0) {
      					_push(0x41b380);
      					_push(0x4120b4);
      					L00401838();
      				}
      				_t111 =  *0x41b380; // 0x2a8e8cc
      				_t58 =  *((intOrPtr*)( *_t111 + 0x14))(_t111,  &_v44);
      				asm("fclex");
      				if(_t58 < _t75) {
      					_push(0x14);
      					_push(_t107);
      					_push(_t111);
      					_push(_t58);
      					L00401832();
      				}
      				_t59 = _v44;
      				_t112 = _t59;
      				_t60 =  *((intOrPtr*)( *_t59 + 0x68))(_t59,  &_v80);
      				asm("fclex");
      				if(_t60 < _t75) {
      					_push(0x68);
      					_push(0x4120c4);
      					_push(_t112);
      					_push(_t60);
      					L00401832();
      				}
      				L0040182C();
      				L00401706();
      				L0040183E();
      				_push(0x41a8b4);
      				L004017E4();
      				L004017E4();
      				L004017E4();
      				return _t60;
      			}













































      0x0041a60e
      0x0041a61d
      0x0041a62a
      0x0041a62d
      0x0041a634
      0x0041a636
      0x0041a639
      0x0041a63f
      0x0041a648
      0x0041a64b
      0x0041a64e
      0x0041a651
      0x0041a654
      0x0041a657
      0x0041a65a
      0x0041a65d
      0x0041a668
      0x0041a66b
      0x0041a672
      0x0041a677
      0x0041a67a
      0x0041a67b
      0x0041a691
      0x0041a699
      0x0041a80d
      0x0041a69f
      0x0041a69f
      0x0041a6a5
      0x0041a6a7
      0x0041a6ac
      0x0041a6b1
      0x0041a6b1
      0x0041a6b6
      0x0041a6c3
      0x0041a6c8
      0x0041a6ca
      0x0041a6dd
      0x0041a6cc
      0x0041a6cc
      0x0041a6d1
      0x0041a6d3
      0x0041a6d4
      0x0041a6d5
      0x0041a6d6
      0x0041a6d6
      0x0041a6e2
      0x0041a6e7
      0x0041a6e8
      0x0041a6f3
      0x0041a6fb
      0x0041a6fd
      0x0041a6ff
      0x0041a704
      0x0041a709
      0x0041a70a
      0x0041a70b
      0x0041a70b
      0x0041a713
      0x0041a71f
      0x0041a721
      0x0041a726
      0x0041a72b
      0x0041a72b
      0x0041a730
      0x0041a73d
      0x0041a742
      0x0041a744
      0x0041a746
      0x0041a748
      0x0041a749
      0x0041a74a
      0x0041a74b
      0x0041a74b
      0x0041a750
      0x0041a75c
      0x0041a75e
      0x0041a766
      0x0041a768
      0x0041a76a
      0x0041a76f
      0x0041a774
      0x0041a775
      0x0041a776
      0x0041a776
      0x0041a77e
      0x0041a786
      0x0041a788
      0x0041a789
      0x0041a78c
      0x0041a793
      0x0041a79d
      0x0041a7a5
      0x0041a7b1
      0x0041a7b3
      0x0041a7b8
      0x0041a7bd
      0x0041a7bd
      0x0041a7c2
      0x0041a7cf
      0x0041a7d4
      0x0041a7d6
      0x0041a7d8
      0x0041a7da
      0x0041a7db
      0x0041a7dc
      0x0041a7dd
      0x0041a7dd
      0x0041a7e2
      0x0041a7e6
      0x0041a7ea
      0x0041a7ef
      0x0041a7f1
      0x0041a7f3
      0x0041a7f5
      0x0041a7fa
      0x0041a7fb
      0x0041a7fc
      0x0041a7fc
      0x0041a804
      0x0041a809
      0x0041a809
      0x0041a812
      0x0041a818
      0x0041a81a
      0x0041a81f
      0x0041a824
      0x0041a824
      0x0041a829
      0x0041a836
      0x0041a83b
      0x0041a83d
      0x0041a83f
      0x0041a841
      0x0041a842
      0x0041a843
      0x0041a844
      0x0041a844
      0x0041a849
      0x0041a853
      0x0041a855
      0x0041a85a
      0x0041a85c
      0x0041a85e
      0x0041a860
      0x0041a865
      0x0041a866
      0x0041a867
      0x0041a867
      0x0041a86f
      0x0041a874
      0x0041a87e
      0x0041a883
      0x0041a89e
      0x0041a8a6
      0x0041a8ae
      0x0041a8b3

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 0041A65D
      • __vbaVarDup.MSVBVM60 ref: 0041A672
      • #562.MSVBVM60(?), ref: 0041A67B
      • __vbaFreeVar.MSVBVM60(?), ref: 0041A691
      • __vbaNew2.MSVBVM60(004120B4,0041B380,?), ref: 0041A6B1
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A6D6
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,00000138), ref: 0041A70B
      • __vbaFreeObj.MSVBVM60(00000000,?,004120C4,00000138), ref: 0041A713
      • __vbaNew2.MSVBVM60(004120B4,0041B380), ref: 0041A72B
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A74B
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,00000138), ref: 0041A776
      • __vbaFreeObj.MSVBVM60(00000000,?,004120C4,00000138), ref: 0041A77E
      • #705.MSVBVM60(?,00000000), ref: 0041A793
      • __vbaStrMove.MSVBVM60(?,00000000), ref: 0041A79D
      • __vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A7A5
      • __vbaNew2.MSVBVM60(004120B4,0041B380,?,00000000), ref: 0041A7BD
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,0000001C), ref: 0041A7DD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120F8,00000050), ref: 0041A7FC
      • __vbaFreeObj.MSVBVM60(00000000,?,004120F8,00000050), ref: 0041A804
      • __vbaNew2.MSVBVM60(004120B4,0041B380,?), ref: 0041A824
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A844
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,00000068), ref: 0041A867
      • __vbaFreeObj.MSVBVM60(00000000,?,004120C4,00000068), ref: 0041A86F
      • #611.MSVBVM60(00000000,?,004120C4,00000068), ref: 0041A874
      • __vbaStrMove.MSVBVM60(00000000,?,004120C4,00000068), ref: 0041A87E
      • __vbaFreeStr.MSVBVM60(0041A8B4), ref: 0041A89E
      • __vbaFreeStr.MSVBVM60(0041A8B4), ref: 0041A8A6
      • __vbaFreeStr.MSVBVM60(0041A8B4), ref: 0041A8AE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
      • String ID: Inferencing$Sprinkelvrkernes
      • API String ID: 3821766861-2317132577
      • Opcode ID: 3e737652869d568708a3bdbb7b334c82183ee6ada8c92f376a8052a3db920369
      • Instruction ID: 7acd801a2199b42636f20cc92c94b70c1aff553b77f7a8b480eea49eaf3cc923
      • Opcode Fuzzy Hash: 3e737652869d568708a3bdbb7b334c82183ee6ada8c92f376a8052a3db920369
      • Instruction Fuzzy Hash: C2718371940208ABCB10EFA5C885EDEBBB8EF18704F54413EF141B71E1DB789995CBA9
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 37%
      			E0041A3A3(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
      				intOrPtr _v8;
      				long long* _v12;
      				char _v28;
      				intOrPtr _v32;
      				char _v36;
      				char _v40;
      				char _v44;
      				intOrPtr _v52;
      				char _v60;
      				intOrPtr _v68;
      				char _v76;
      				intOrPtr _v84;
      				char _v92;
      				intOrPtr _v100;
      				char _v108;
      				char _v176;
      				char* _t54;
      				void* _t57;
      				intOrPtr* _t58;
      				void* _t59;
      				void* _t61;
      				intOrPtr* _t62;
      				void* _t63;
      				intOrPtr* _t64;
      				char _t65;
      				void* _t67;
      				intOrPtr* _t97;
      				intOrPtr* _t98;
      				intOrPtr* _t99;
      				intOrPtr* _t100;
      				intOrPtr* _t101;
      				intOrPtr _t104;
      				long long* _t105;
      				intOrPtr _t108;
      				intOrPtr _t111;
      
      				_push(0x401676);
      				_t54 =  *[fs:0x0];
      				_push(_t54);
      				 *[fs:0x0] = _t104;
      				_t105 = _t104 - 0xb4;
      				_v12 = _t105;
      				_v8 = 0x401640;
      				asm("fldz");
      				 *_t105 = __fp0;
      				_v28 = 0;
      				_v36 = 0;
      				_v40 = 0;
      				_v44 = 0;
      				_v60 = 0;
      				_v76 = 0;
      				_v92 = 0;
      				_v108 = 0;
      				_v176 = 0;
      				L00401724();
      				L0040172A();
      				asm("fcomp qword [0x401638]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(0 != 0) {
      					_push(0);
      					_push( &_v60);
      					_v52 = 1;
      					_v60 = 2;
      					L0040171E();
      					L0040183E();
      					L00401802();
      					_t108 =  *0x41b380; // 0x2a8e8cc
      					if(_t108 == 0) {
      						_push(0x41b380);
      						_push(0x4120b4);
      						L00401838();
      					}
      					_t97 =  *0x41b380; // 0x2a8e8cc
      					_t57 =  *((intOrPtr*)( *_t97 + 0x14))(_t97,  &_v44);
      					asm("fclex");
      					if(_t57 < 0) {
      						_push(0x14);
      						_push(0x4120a4);
      						_push(_t97);
      						_push(_t57);
      						L00401832();
      					}
      					_t58 = _v44;
      					_t98 = _t58;
      					_t59 =  *((intOrPtr*)( *_t58 + 0xd0))(_t58,  &_v40);
      					asm("fclex");
      					if(_t59 < 0) {
      						_push(0xd0);
      						_push(0x4120c4);
      						_push(_t98);
      						_push(_t59);
      						L00401832();
      					}
      					_v40 = 0;
      					L0040183E();
      					L0040182C();
      					_t111 =  *0x41b380; // 0x2a8e8cc
      					if(_t111 == 0) {
      						_push(0x41b380);
      						_push(0x4120b4);
      						L00401838();
      					}
      					_t99 =  *0x41b380; // 0x2a8e8cc
      					_t61 =  *((intOrPtr*)( *_t99 + 0x14))(_t99,  &_v44);
      					asm("fclex");
      					if(_t61 < 0) {
      						_push(0x14);
      						_push(0x4120a4);
      						_push(_t99);
      						_push(_t61);
      						L00401832();
      					}
      					_t62 = _v44;
      					_t100 = _t62;
      					_t63 =  *((intOrPtr*)( *_t62 + 0xb8))(_t62,  &_v176);
      					asm("fclex");
      					if(_t63 < 0) {
      						_push(0xb8);
      						_push(0x4120c4);
      						_push(_t100);
      						_push(_t63);
      						L00401832();
      					}
      					L0040182C();
      					L00401712();
      					_t64 =  &_v44;
      					L00401718();
      					_t101 = _t64;
      					_v100 = 0x80020004;
      					_v84 = 0x80020004;
      					_v68 = 0x80020004;
      					_v52 = 0x80020004;
      					_t65 = 0xa;
      					_v108 = _t65;
      					_v92 = _t65;
      					_v76 = _t65;
      					_v60 = _t65;
      					_t67 =  *((intOrPtr*)( *_t101 + 0x44))(_t101, 0x7304,  &_v60,  &_v76,  &_v92,  &_v108, _t64, _t63);
      					asm("fclex");
      					if(_t67 < 0) {
      						_push(0x44);
      						_push(0x4141ac);
      						_push(_t101);
      						_push(_t67);
      						L00401832();
      					}
      					L0040182C();
      					_push( &_v108);
      					_push( &_v92);
      					_push( &_v76);
      					_t54 =  &_v60;
      					_push(_t54);
      					_push(4);
      					L0040181A();
      				}
      				asm("wait");
      				_push(0x41a5f0);
      				_v32 =  *0x401630;
      				L004017E4();
      				L004017E4();
      				return _t54;
      			}






































      0x0041a3a8
      0x0041a3ad
      0x0041a3b3
      0x0041a3b4
      0x0041a3bb
      0x0041a3c4
      0x0041a3c7
      0x0041a3d0
      0x0041a3d4
      0x0041a3d7
      0x0041a3da
      0x0041a3dd
      0x0041a3e0
      0x0041a3e3
      0x0041a3e6
      0x0041a3e9
      0x0041a3ec
      0x0041a3ef
      0x0041a3f5
      0x0041a3fa
      0x0041a3ff
      0x0041a405
      0x0041a407
      0x0041a408
      0x0041a411
      0x0041a412
      0x0041a413
      0x0041a41a
      0x0041a421
      0x0041a42b
      0x0041a433
      0x0041a438
      0x0041a43e
      0x0041a440
      0x0041a445
      0x0041a44a
      0x0041a44a
      0x0041a44f
      0x0041a45c
      0x0041a461
      0x0041a463
      0x0041a465
      0x0041a467
      0x0041a46c
      0x0041a46d
      0x0041a46e
      0x0041a46e
      0x0041a473
      0x0041a47d
      0x0041a47f
      0x0041a487
      0x0041a489
      0x0041a48b
      0x0041a490
      0x0041a495
      0x0041a496
      0x0041a497
      0x0041a497
      0x0041a4a2
      0x0041a4a5
      0x0041a4ad
      0x0041a4b2
      0x0041a4b8
      0x0041a4ba
      0x0041a4bf
      0x0041a4c4
      0x0041a4c4
      0x0041a4c9
      0x0041a4d6
      0x0041a4db
      0x0041a4dd
      0x0041a4df
      0x0041a4e1
      0x0041a4e6
      0x0041a4e7
      0x0041a4e8
      0x0041a4e8
      0x0041a4ed
      0x0041a4fa
      0x0041a4fc
      0x0041a504
      0x0041a506
      0x0041a508
      0x0041a50d
      0x0041a512
      0x0041a513
      0x0041a514
      0x0041a514
      0x0041a51c
      0x0041a521
      0x0041a527
      0x0041a52b
      0x0041a537
      0x0041a539
      0x0041a53c
      0x0041a53f
      0x0041a542
      0x0041a545
      0x0041a549
      0x0041a558
      0x0041a55b
      0x0041a55e
      0x0041a56a
      0x0041a56f
      0x0041a571
      0x0041a573
      0x0041a575
      0x0041a57a
      0x0041a57b
      0x0041a57c
      0x0041a57c
      0x0041a584
      0x0041a58c
      0x0041a590
      0x0041a594
      0x0041a595
      0x0041a598
      0x0041a599
      0x0041a59b
      0x0041a5a0
      0x0041a5a9
      0x0041a5aa
      0x0041a5af
      0x0041a5e2
      0x0041a5ea
      0x0041a5ef

      APIs
      • #585.MSVBVM60 ref: 0041A3F5
      • __vbaFpR8.MSVBVM60 ref: 0041A3FA
      • #705.MSVBVM60(?,00000000), ref: 0041A421
      • __vbaStrMove.MSVBVM60(?,00000000), ref: 0041A42B
      • __vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A433
      • __vbaNew2.MSVBVM60(004120B4,0041B380,?,00000000), ref: 0041A44A
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A46E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,000000D0), ref: 0041A497
      • __vbaStrMove.MSVBVM60(00000000,?,004120C4,000000D0), ref: 0041A4A5
      • __vbaFreeObj.MSVBVM60(00000000,?,004120C4,000000D0), ref: 0041A4AD
      • __vbaNew2.MSVBVM60(004120B4,0041B380), ref: 0041A4C4
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A4E8
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,000000B8), ref: 0041A514
      • __vbaFreeObj.MSVBVM60(00000000,?,004120C4,000000B8), ref: 0041A51C
      • #685.MSVBVM60(00000000,?,004120C4,000000B8), ref: 0041A521
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041A52B
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004141AC,00000044), ref: 0041A57C
      • __vbaFreeObj.MSVBVM60(00000000,00000000,004141AC,00000044), ref: 0041A584
      • __vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0041A59B
      • __vbaFreeStr.MSVBVM60(0041A5F0), ref: 0041A5E2
      • __vbaFreeStr.MSVBVM60(0041A5F0), ref: 0041A5EA
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
      • String ID:
      • API String ID: 1883905597-0
      • Opcode ID: 9ddf499ec28a2e4857257b5435abaf36adfa38b1d428438e62cebd765894c66e
      • Instruction ID: dc5bb6ffb9fe162e1314bac1bce0740ea7059f9c9cfabb073bbf9884aea00fb6
      • Opcode Fuzzy Hash: 9ddf499ec28a2e4857257b5435abaf36adfa38b1d428438e62cebd765894c66e
      • Instruction Fuzzy Hash: F6518DB1D40208AFCB14EF95C886EDEBBB8EF48304F14412BF105B71A1DB785985CB69
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 57%
      			E0041A1E8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				char _v8;
      				intOrPtr _v16;
      				intOrPtr _v20;
      				intOrPtr _v24;
      				intOrPtr _v28;
      				short _v40;
      				void* _v44;
      				void* _v48;
      				signed int _v56;
      				char _v64;
      				intOrPtr _v72;
      				char _v80;
      				intOrPtr _v88;
      				char _v96;
      				intOrPtr _v104;
      				char _v112;
      				char* _v120;
      				intOrPtr _v128;
      				char* _t48;
      				void* _t69;
      				void* _t71;
      				intOrPtr _t72;
      
      				_t72 = _t71 - 0x18;
      				 *[fs:0x0] = _t72;
      				L00401670();
      				_v28 = _t72;
      				_v24 = 0x4015e8;
      				_v20 = 0;
      				_v16 = 0;
      				_t48 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t69);
      				_v8 = 1;
      				_v8 = 2;
      				_push(0x41418c);
      				L0040173C();
      				if(_t48 != 2) {
      					_v8 = 3;
      					_v56 = _v56 & 0x00000000;
      					_v64 = 2;
      					_push(0xfffffffe);
      					_push(0xfffffffe);
      					_push(0xfffffffe);
      					_push(0xffffffff);
      					_push( &_v64);
      					L00401736();
      					L0040183E();
      					L00401802();
      					_v8 = 4;
      					_push(0);
      					L00401814();
      					_v8 = 5;
      					_push(0);
      					_push(0);
      					_push(1);
      					L00401730();
      					L0040183E();
      					_v8 = 6;
      					_v104 = 0x80020004;
      					_v112 = 0xa;
      					_v88 = 0x80020004;
      					_v96 = 0xa;
      					_v72 = 0x80020004;
      					_v80 = 0xa;
      					_v120 = L"Gregarinian";
      					_v128 = 8;
      					L00401760();
      					_push( &_v112);
      					_push( &_v96);
      					_push( &_v80);
      					_push(0);
      					_push( &_v64);
      					L00401772();
      					_push( &_v112);
      					_push( &_v96);
      					_push( &_v80);
      					_t48 =  &_v64;
      					_push(_t48);
      					_push(4);
      					L0040181A();
      				}
      				_v8 = 8;
      				_push(0xffffffff);
      				L00401814();
      				_v8 = 9;
      				_v40 = 0x74be;
      				_push(0x41a37a);
      				L004017E4();
      				L004017E4();
      				return _t48;
      			}

























      0x0041a1eb
      0x0041a1fa
      0x0041a206
      0x0041a20e
      0x0041a211
      0x0041a218
      0x0041a21f
      0x0041a22e
      0x0041a231
      0x0041a238
      0x0041a23f
      0x0041a244
      0x0041a24c
      0x0041a252
      0x0041a259
      0x0041a25d
      0x0041a264
      0x0041a266
      0x0041a268
      0x0041a26a
      0x0041a26f
      0x0041a270
      0x0041a27a
      0x0041a282
      0x0041a287
      0x0041a28e
      0x0041a290
      0x0041a295
      0x0041a29c
      0x0041a29e
      0x0041a2a0
      0x0041a2a2
      0x0041a2ac
      0x0041a2b1
      0x0041a2b8
      0x0041a2bf
      0x0041a2c6
      0x0041a2cd
      0x0041a2d4
      0x0041a2db
      0x0041a2e2
      0x0041a2e9
      0x0041a2f6
      0x0041a2fe
      0x0041a302
      0x0041a306
      0x0041a307
      0x0041a30c
      0x0041a30d
      0x0041a315
      0x0041a319
      0x0041a31d
      0x0041a31e
      0x0041a321
      0x0041a322
      0x0041a324
      0x0041a329
      0x0041a32c
      0x0041a333
      0x0041a335
      0x0041a33a
      0x0041a341
      0x0041a347
      0x0041a36c
      0x0041a374
      0x0041a379

      APIs
      • __vbaChkstk.MSVBVM60(?,00401676), ref: 0041A206
      • __vbaI4Str.MSVBVM60(0041418C,?,?,?,?,00401676), ref: 0041A244
      • #704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A270
      • __vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A27A
      • __vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A282
      • __vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A290
      • #706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2A2
      • __vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2AC
      • __vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2F6
      • #595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 0041A30D
      • __vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 0041A324
      • __vbaOnError.MSVBVM60(000000FF,0041418C,?,?,?,?,00401676), ref: 0041A335
      • __vbaFreeStr.MSVBVM60(0041A37A,000000FF,0041418C), ref: 0041A36C
      • __vbaFreeStr.MSVBVM60(0041A37A,000000FF,0041418C), ref: 0041A374
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
      • String ID: Gregarinian
      • API String ID: 2605556234-529014253
      • Opcode ID: 6b87d6161114a2d520fba3d4242d1d7f43fd865fd14090cf227916920f2834ad
      • Instruction ID: 220fb999eb52fcffe282df0149c17b3b7a4576b6cbf5fe523687bd0c37604b92
      • Opcode Fuzzy Hash: 6b87d6161114a2d520fba3d4242d1d7f43fd865fd14090cf227916920f2834ad
      • Instruction Fuzzy Hash: 7E41FCB1D0120CABDB10EFD5C945BDDB7B9AF04314F60812AF121BB2E1DBB95A09CB59
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(004120B4,0041B380), ref: 0041A913
      • __vbaHresultCheckObj.MSVBVM60(00000000,02A8E8CC,004120A4,00000014), ref: 0041A937
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120C4,000000C8), ref: 0041A960
      • __vbaFreeObj.MSVBVM60 ref: 0041A968
      Memory Dump Source
      • Source File: 00000000.00000002.756796265.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.756772204.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.756945760.000000000041B000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.756965393.000000000041C000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckHresult$FreeNew2
      • String ID:
      • API String ID: 4261391273-0
      • Opcode ID: 8fd75c7f084d5b7965c06047a686fba5579c1fcc7c0c817b8fbf7b1e64880092
      • Instruction ID: 201f932695c3a04c8635a1299b291ef1c432f09277c07c694ca7fd4c4a5b23b1
      • Opcode Fuzzy Hash: 8fd75c7f084d5b7965c06047a686fba5579c1fcc7c0c817b8fbf7b1e64880092
      • Instruction Fuzzy Hash: 4611A3B1981208BFD7109B95CC46EEFBAA8EB54704F10462AF100B31E1D7B81991CBE9
      Uniqueness

      Uniqueness Score: -1.00%